nightly-artifacts.yml

name: Nightly Artifact Build

on:
  workflow_call:
    inputs:
      checkout_ref:
        description: "Commit SHA or ref to build."
        required: true
        type: string
      version:
        description: "Prerelease version projected into every artifact producer."
        required: true
        type: string
      artifact_prefix:
        description: "Prefix isolating artifacts in the caller run."
        required: true
        type: string
      artifact_retention_days:
        description: "Retention for build artifacts."
        required: false
        default: 1
        type: number
      build_desktop_packages:
        description: "Whether to run Desktop/Installer package producers."
        required: false
        default: true
        type: boolean
      desktop_platforms:
        description: "JSON array of Desktop/Installer platform names to package."
        required: false
        default: '["linux-x64","linux-arm64","macos-arm64","macos-x64","windows-x64"]'
        type: string
      build_linux_binaries:
        description: "Whether to build Linux CLI and Relay archives."
        required: false
        default: true
        type: boolean
      build_relay_image:
        description: "Whether to validate the Relay runtime image without publishing it."
        required: false
        default: true
        type: boolean
      upload_artifacts:
        description: "Whether to upload package outputs for a publishing caller."
        required: false
        default: true
        type: boolean
      cache_write:
        description: "Allow a trusted non-PR caller to refresh build caches."
        required: false
        default: false
        type: boolean
    secrets:
      TAURI_SIGNING_PRIVATE_KEY:
        required: false
      TAURI_SIGNING_PRIVATE_KEY_PASSWORD:
        required: false
      TAURI_UPDATER_PUBKEY:
        required: false

permissions:
  contents: read

jobs:
  # ── Patch version for nightly ──────────────────────────────────────
  package:
    name: Package (${{ matrix.platform }})
    if: ${{ inputs.build_desktop_packages }}
    runs-on: ${{ fromJSON('{"linux-x64":"ubuntu-latest","linux-arm64":"ubuntu-24.04-arm","macos-arm64":"macos-15","macos-x64":"macos-15-intel","windows-x64":"windows-latest"}')[matrix.platform] }}
    env:
      NODE_OPTIONS: --max-old-space-size=6144
      OPENBITFUN_RELEASE_CHANNEL: nightly
      # Nightly does not publish a Tauri latest-v1.json feed yet. Preserve its
      # existing stable updater endpoints until that publishing path exists.
      TAURI_UPDATER_ENDPOINT: https://github.com/GCWing/OpenBitFun/releases/latest/download/latest-v1.json
      TAURI_UPDATER_FALLBACK_ENDPOINT: https://openbitfun.com/release/latest-v1.json
      # Nightly relay archives are signed too (linux-binaries.yml receives the
      # key), so nightly Desktop needs the same trust root to verify them.
      OPENBITFUN_RELEASE_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
      PACKAGE_TARGET: ${{ fromJSON('{"linux-x64":"x86_64-unknown-linux-gnu","linux-arm64":"aarch64-unknown-linux-gnu","macos-arm64":"aarch64-apple-darwin","macos-x64":"x86_64-apple-darwin","windows-x64":"x86_64-pc-windows-msvc"}')[matrix.platform] }}

    strategy:
      fail-fast: false
      matrix:
        platform: ${{ fromJSON(inputs.desktop_platforms) }}

    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ inputs.checkout_ref }}

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.14"
          no-cache: true

      - name: Install Linux system dependencies (Tauri bundler)
        if: runner.os == 'Linux'
        shell: bash
        run: |
          sudo apt-get update

          if apt-cache show libwebkit2gtk-4.1-dev >/dev/null 2>&1; then
            WEBKIT_PKG=libwebkit2gtk-4.1-dev
          else
            WEBKIT_PKG=libwebkit2gtk-4.0-dev
          fi

          if apt-cache show libappindicator3-dev >/dev/null 2>&1; then
            APPINDICATOR_PKG=libappindicator3-dev
          else
            APPINDICATOR_PKG=libayatana-appindicator3-dev
          fi

          # Tauri pins AppImage GTK input methods to its bundled cache, so the
          # fcitx5 GTK3 bridge must be present before linuxdeploy builds it.
          sudo apt-get install -y --no-install-recommends \
            pkg-config \
            xdg-utils \
            libglib2.0-dev \
            libgtk-3-dev \
            libgstreamer1.0-dev \
            libgstreamer-plugins-base1.0-dev \
            gstreamer1.0-pipewire \
            gstreamer1.0-plugins-base \
            gstreamer1.0-plugins-good \
            fcitx5-frontend-gtk3 \
            libxdo-dev \
            "$WEBKIT_PKG" \
            "$APPINDICATOR_PKG" \
            librsvg2-dev \
            patchelf \
            fakeroot \
            rpm \
            libleptonica-dev \
            libtesseract-dev \
            tesseract-ocr \
            tesseract-ocr-eng

      - name: Setup pnpm
        uses: pnpm/action-setup@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 22
          package-manager-cache: false

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ env.PACKAGE_TARGET }}

      - name: Cache Rust build
        uses: swatinem/rust-cache@v2
        with:
          shared-key: "nightly-v3-${{ github.base_ref || github.ref_name }}-${{ matrix.platform }}"
          cache-bin: false
          # A PR merge ref can never become a reusable base cache. Even a
          # trusted caller cannot override this guard.
          save-if: ${{ inputs.cache_write && github.event_name != 'pull_request' }}
          cache-on-failure: ${{ inputs.cache_write && github.event_name != 'pull_request' }}

      - name: Verify committed Cargo metadata
        run: cargo metadata --locked --no-deps

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Verify Installer i18n projection
        if: runner.os == 'Windows'
        run: pnpm --dir OpenBitFun-Installer run sync:i18n

      - name: Verify Installer Tauri package alignment
        if: runner.os == 'Windows'
        shell: bash
        run: |
          set -euo pipefail
          info="$(pnpm --dir OpenBitFun-Installer exec tauri info 2>&1)"
          printf '%s\n' "$info"
          if grep -Fq 'Error: Found version mismatched Tauri packages.' <<<"$info"; then
            exit 1
          fi

      - name: Build plugin Host resources
        run: |
          bun install --cwd src/apps/extension-host --frozen-lockfile
          bun run --cwd src/apps/extension-host build

      - name: Generate web API bindings
        run: pnpm --dir src/web-ui run gen:types

      - name: Type-check web UI
        run: pnpm run type-check:web

      - name: Patch nightly version
        shell: bash
        env:
          NIGHTLY_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail

          echo "Patching version to $NIGHTLY_VERSION"
          ASSET_VERSION="${NIGHTLY_VERSION%%+*}"
          node scripts/set-build-version.mjs --version "$ASSET_VERSION"

          echo "package.json version: $(jq -r '.version' package.json)"
          echo "Cargo.toml version:   $(grep 'x-release-please-version' Cargo.toml)"

      - name: Verify projected Cargo metadata
        run: cargo metadata --locked --no-deps

      - name: Run Windows CLI terminal contracts
        if: runner.os == 'Windows'
        env:
          CARGO_INCREMENTAL: "0"
          CARGO_PROFILE_DEV_DEBUG: "0"
          CARGO_PROFILE_TEST_DEBUG: "0"
        run: cargo test --locked -p openbitfun-cli --test terminal_process_contracts -- --test-threads=1

      - name: Select Xcode for macOS Icon Composer assets
        if: runner.os == 'macOS'
        shell: bash
        run: |
          test -d /Applications/Xcode_26.2.app/Contents/Developer
          echo "DEVELOPER_DIR=/Applications/Xcode_26.2.app/Contents/Developer" >> "$GITHUB_ENV"

      - name: Verify native macOS icon bundling
        if: runner.os == 'macOS'
        env:
          OPENBITFUN_TEST_MACOS_BUNDLE: '1'
        run: node --test scripts/macos-icon-bundle.test.mjs

      - name: Build desktop app
        shell: bash
        run: |
          case "${{ matrix.platform }}" in
            linux-x64)
              pnpm run desktop:build:linux -- --target x86_64-unknown-linux-gnu --bundles deb,rpm,appimage
              ;;
            linux-arm64)
              CARGO_PROFILE_RELEASE_LTO=thin pnpm run desktop:build:linux -- --target aarch64-unknown-linux-gnu --bundles deb,rpm,appimage
              ;;
            macos-arm64)
              pnpm run desktop:build:arm64
              ;;
            macos-x64)
              pnpm run desktop:build:x86_64
              ;;
            windows-x64)
              pnpm run installer:build
              ;;
            *)
              echo "Unsupported package platform: ${{ matrix.platform }}" >&2
              exit 1
              ;;
          esac

      - name: Package macOS CLI for SSH dispatch
        if: runner.os == 'macOS'
        id: macos-cli
        shell: bash
        env:
          NIGHTLY_VERSION: ${{ inputs.version }}
          TARGET: ${{ env.PACKAGE_TARGET }}
        run: |
          set -euo pipefail
          ASSET_VERSION="${NIGHTLY_VERSION%%+*}"
          cargo build --release --target "$TARGET" -p openbitfun-cli
          bash scripts/cli/package-unix.sh "$ASSET_VERSION" "$TARGET"

      - name: Sign macOS CLI archive and checksum
        if: runner.os == 'macOS'
        shell: bash
        env:
          OPENBITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          OPENBITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          OPENBITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
        run: |
          set -euo pipefail
          bash scripts/sign-release-assets.sh \
            "${{ steps.macos-cli.outputs.archive }}" \
            "${{ steps.macos-cli.outputs.checksum }}"

      - name: Verify AppImage fcitx5 GTK module
        if: runner.os == 'Linux'
        shell: bash
        run: bash scripts/ci/verify-appimage-fcitx.sh "${{ env.PACKAGE_TARGET }}"

      # Keep output validation independent from artifact upload. PR callers do
      # not upload packages, but still need evidence that every selected
      # producer emitted the files its publishing caller will collect.
      - name: Verify package outputs
        shell: bash
        run: |
          set -euo pipefail

          find_bundle_file() {
            local pattern="$1"
            local root
            for root in \
              "target/${PACKAGE_TARGET}/release/bundle" \
              "target/release/bundle" \
              "src/apps/desktop/target/${PACKAGE_TARGET}/release/bundle" \
              "src/apps/desktop/target/release/bundle"; do
              if [[ -d "$root" ]] && find "$root" -type f -name "$pattern" -size +0c -print -quit | grep -q .; then
                return 0
              fi
            done
            echo "Missing non-empty package output matching $pattern for ${{ matrix.platform }}" >&2
            return 1
          }

          find_bundle_dir() {
            local pattern="$1"
            local root
            for root in \
              "target/${PACKAGE_TARGET}/release/bundle" \
              "target/release/bundle" \
              "src/apps/desktop/target/${PACKAGE_TARGET}/release/bundle" \
              "src/apps/desktop/target/release/bundle"; do
              if [[ -d "$root" ]] && find "$root" -type d -name "$pattern" -print -quit | grep -q .; then
                return 0
              fi
            done
            echo "Missing package directory matching $pattern for ${{ matrix.platform }}" >&2
            return 1
          }

          case "${{ matrix.platform }}" in
            linux-*)
              find_bundle_file '*.deb'
              find_bundle_file '*.rpm'
              find_bundle_file '*.AppImage'
              ;;
            macos-*)
              find_bundle_dir '*.app'
              find_bundle_file '*.dmg'
              shopt -s nullglob
              cli_archives=(openbitfun-cli-*-"${PACKAGE_TARGET}".tar.gz)
              [[ ${#cli_archives[@]} -eq 1 ]]
              test -s "${cli_archives[0]}"
              test -s "${cli_archives[0]}.sha256"
              ;;
            windows-x64)
              test -s OpenBitFun-Installer/src-tauri/target/release/openbitfun-installer.exe
              ;;
            *)
              echo "Unsupported package platform: ${{ matrix.platform }}" >&2
              exit 1
              ;;
          esac

      - name: Upload bundles
        if: ${{ inputs.upload_artifacts }}
        uses: actions/upload-artifact@v6
        with:
          name: openbitfun-${{ inputs.artifact_prefix }}-${{ matrix.platform }}-bundle
          if-no-files-found: error
          retention-days: ${{ inputs.artifact_retention_days }}
          path: |
            target/*/release/bundle
            target/release/bundle
            src/apps/desktop/target/release/bundle
            OpenBitFun-Installer/src-tauri/target/release/openbitfun-installer.exe
            openbitfun-cli-*-apple-darwin.tar.gz
            openbitfun-cli-*-apple-darwin.tar.gz.sha256
            openbitfun-cli-*-apple-darwin.tar.gz.sig
            openbitfun-cli-*-apple-darwin.tar.gz.sha256.sig

  linux-binaries:
    name: Linux CLI and Relay Server
    if: ${{ inputs.build_linux_binaries || inputs.build_relay_image }}
    uses: ./.github/workflows/linux-binaries.yml
    secrets:
      release_signing_key: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
      release_signing_password: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
      release_pubkey: ${{ secrets.TAURI_UPDATER_PUBKEY }}
    with:
      checkout_ref: ${{ inputs.checkout_ref }}
      version: ${{ inputs.version }}
      artifact_prefix: ${{ inputs.artifact_prefix }}
      artifact_retention_days: ${{ inputs.artifact_retention_days }}
      upload_artifacts: ${{ inputs.upload_artifacts }}
      cache_write: ${{ inputs.cache_write }}
      validate_relay_image: ${{ inputs.build_relay_image }}